Last updated: October 2026

1. Controller

Latrock GmbH
Im Obergrund 2, 65232 Taunusstein
Email: contact@zeitbro.com

("we", "us", "our") is the controller within the meaning of Art. 4(7) GDPR for the processing of personal data described below.

We are not required to appoint a Data Protection Officer under Art. 37 GDPR. For data protection inquiries, contact us at contact@zeitbro.com.

Competent supervisory authority:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
https://datenschutz.hessen.de

2. What Data We Collect

2.1 Account Data

When you register, we collect:

Name
Email address
Hashed password (for email/password sign-up)
OAuth profile information (for social sign-up via Google or GitHub)

2.2 Usage Data

When you use the service, we process:

Time entries (come/leave times, pause, work minutes, status)
Project tasks and durations
User settings and preferences
Device identifiers and heartbeat timestamps for timer conflict prevention

2.3 Technical Data

Our infrastructure providers may automatically collect:

IP address
Browser type and version
Device information
Timestamps of requests

3. Legal Basis (Art. 6 GDPR)

We process your data on the following legal bases:

Art. 6(1)(b) GDPR - Performance of contract: processing necessary to provide the time tracking service you signed up for.
Art. 6(1)(f) GDPR - Legitimate interest: technical logging for security and service stability.
Art. 6(1)(a) GDPR - Consent: audience measurement and marketing on our public website, only after you agree via the cookie banner (see section 6).

3.1 Automated Decision-Making

We do not use automated decision-making or profiling as defined in Art. 22 GDPR.

4. Data Processors

We use the following third-party processors. A data processing agreement pursuant to Art. 28 GDPR is in place with each processor.

Convex, Inc. (USA, data hosted in EU) - Backend database and serverless functions
Vercel, Inc. (USA, data hosted in EU) - Web application hosting
Mailgun Technologies, Inc. (USA, data hosted in EU) - Transactional email delivery, including contact form messages
Google Ireland Ltd. (Ireland) - Google Analytics for audience measurement (only after your consent)

5. International Data Transfers

All data processors store and process your data within the European Union. The processor companies are headquartered in the USA and participate in the EU-US Data Privacy Framework. For transfers by Meta through the Meta Pixel, see section 6.

6. Cookies & Audience Measurement

To operate the application we use strictly necessary cookies (session tokens for authentication). No consent is required for these under Section 25(2) TDDDG.

On our public website we use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) for audience measurement — but only after you have explicitly consented via our cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without your consent, Google Analytics is not loaded and no data is sent to Google; the IP address is processed in truncated form and not stored.

With your consent in the "Marketing" category we also use the Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland). It measures whether visits come from our ads on Facebook and Instagram and lets us show ads there to people who visited our website. In doing so, in particular your IP address, browser and device information, the page visited and clicks on the buttons leading to the app are transmitted to Meta, and the cookies _fbp and — when you arrive from an ad — _fbc are set (each stored for 90 days). If you are logged in to Facebook or Instagram, Meta can link the visit to your account. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); without it, the Meta Pixel is not loaded.

We are jointly responsible with Meta for collecting this data and transmitting it to Meta (Art. 26 GDPR); the agreement covering this is Meta's Controller Addendum. You can exercise your rights against us as well as against Meta (Art. 26(3) GDPR). Meta alone is responsible for any further processing. Meta may transfer data to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. For more information, see Meta's Privacy Policy.

You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer. For more information on Google's data processing, see Google's Privacy Policy.

7. Security Measures

We implement appropriate technical and organizational measures to protect your data:

Data transmission encryption (TLS/HTTPS)
Encryption at rest for stored data
Hashed password storage (bcrypt)
Access control based on the principle of least privilege
Regular security reviews of our infrastructure

8. Data Retention & Breach Notification

We retain your data for as long as your account exists. When you delete your account, all personal data is deleted. We may retain anonymized, aggregated data for service improvement and analytics purposes. Contact form messages are retained in our mailbox; we additionally store a hash of the sender's address for abuse prevention.

Technical log data (server logs) is retained for a maximum of 90 days. If we introduce payment features in the future, billing data will be retained in accordance with commercial and tax law retention periods (10 years, HGB/AO).

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Art. 34 GDPR. The competent supervisory authority will be informed within 72 hours in accordance with Art. 33 GDPR.

9. Your Rights

Under the GDPR, you have the right to:

Access your personal data (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Object to processing (Art. 21 GDPR)
Lodge a complaint with a supervisory authority (Art. 77 GDPR)
Withdraw consent at any time with future effect (Art. 7(3) GDPR)

To exercise your rights, email contact@zeitbro.com. We will respond within one month (Art. 12(3) GDPR). You can export your data from Settings at any time.

10. Changes

We may update this privacy policy from time to time. We will notify you of material changes by email or through the service. Material changes require re-acceptance through the Service.